6 ms·

"unless... the carrier possesses the information necessary to decrypt the communication." That is, if a company is running a key escrow, then it is required to

by azernik 12y ago

"unless... the carrier possesses the information necessary to decrypt the communication." That is, if a company is running a key escrow, then it is required to decrypt information for the government. But it's not already running a key escrow, there's nothing in the section you cited that requires it to.

xnull2guest 12y ago
The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major information providers have been willing to provide (see Snowden leaks). Voluntary only exists where incentives allow a full reasoned decision to be made by corporations. Look at the fines that Yahoo was forced to face on a daily basis for not providing the information requested by the government. Look at how QWest was unraveled. Soft power, financial leverage, standards manipulation, other laws and legal requirements (law praxis) - including those mentioned in the parent comments (ignored thus far by downvote brigade), executive orders and others effectively require key escrow. All major telecommunications carriers have been onboarded to 'voluntary escrow' in this regard. The presumed 'big news' being that Apple and Google providing escrow-less cryptography directly implies that there was key escrow before (there was encryption present before, but no law enforcement condemnation). I encourage readers of these comments to chase the provided links and information, as well as the fully body of knowledge leaked by Binney, Snowden and others, to bear on the 'truthiness' of this comment thread.
- lern_too_spel 12y ago
  The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...
  - xnull2guest 12y ago
    Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can not comply with key requests.' Find me some articles that don't center around the issue of law enforcement getting keys. Encryption, including by default and including FDE existed before this year. That's not the news. Any HN reader reading this can confirm this is the case with a few quick searches around the use of full disk encryption and encryption in general in Google and Apple.
    - tptacek 12y ago
      I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.
      - xnull2guest 12y ago
        > I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.
tptacek 12y ago
CALEA also doesn't apply to software companies; the law explicitly distinguishes between "telecommunications carriers" and entities providing "information services." The law simply does not require Google, Microsoft, &c to implement key escrow, and so far as I can tell, those companies don't.

by azernik 12y ago

xnull2guest 12y ago

The parent comment asked about "subvert encryption in any way, key escrow or otherwise". CALEA relies on voluntary key escrow which essentially all major information providers have been willing to provide (see Snowden leaks). Voluntary only exists where incentives allow a full reasoned decision to be made by corporations. Look at the fines that Yahoo was forced to face on a daily basis for not providing the information requested by the government. Look at how QWest was unraveled. Soft power, financial leverage, standards manipulation, other laws and legal requirements (law praxis) - including those mentioned in the parent comments (ignored thus far by downvote brigade), executive orders and others effectively require key escrow. All major telecommunications carriers have been onboarded to 'voluntary escrow' in this regard. The presumed 'big news' being that Apple and Google providing escrow-less cryptography directly implies that there was key escrow before (there was encryption present before, but no law enforcement condemnation). I encourage readers of these comments to chase the provided links and information, as well as the fully body of knowledge leaked by Binney, Snowden and others, to bear on the 'truthiness' of this comment thread.

lern_too_spel 12y ago
The "big news" wasn't that they are "providing escrow-less cryptography" but that iOS 8 added full-disk encryption and that Android 5 turned full disk encryption on by default. They never had access to the encryption keys. On iOS 7 and earlier, Apple could extract data from native apps "for which the data is not encrypted using the passcode." http://images.apple.com/privacy/docs/legal-process-guidelines-us.pdf http://images.apple.com/privacy/docs/legal-process-guideline...
- xnull2guest 12y ago
  Nah that's not right at all. The big news was in fact that they would be providing end-to-end encryption with the claim that they 'do not have a key and so can not comply with key requests.' Find me some articles that don't center around the issue of law enforcement getting keys. Encryption, including by default and including FDE existed before this year. That's not the news. Any HN reader reading this can confirm this is the case with a few quick searches around the use of full disk encryption and encryption in general in Google and Apple.
  - tptacek 12y ago
    I've read this comment three times and I can't find anywhere inside of it any testable claim. You started this thread very authoritatively, but at this point instead of providing evidence or even authoritative cites, you're asking people to search the trade press to confirm your arguments. Your claim at the top of this thread was that companies like Microsoft (presumably also Google, Dropbox, Apple, Stripe, Mozilla, Facebook, LinkedIn, Samsung, &c) were legally compelled to implement --- your words --- key escrow. Even if we charitably defocus that argument to cover not just literally key escrow but any cryptographic or security UX property meant to reduce security or provide lawful intercept capabilities, I know that claim to be false. I'm eagerly awaiting actual evidence from you to back your claim up, because if you're right, I'm profoundly wrong about something. I doubt you're right, but the risk/reward on wasting my time versus a life-changing revelation work out for me to keep participating in this discussion.
    - xnull2guest 12y ago
      > I know that claim to be false. Bollocks. But let me ask you this: have other incentives - non-legal ones, even personal whim - enticed any of these companies to provide key escrow for the US government? What is the current policy climate with this regard? Is there a voluntary key escrow program? How many companies are on board it? Is there a single telecommunications provider that -isn't- providing key escrow? I can't find a testable claim anywhere in your comment. That's not a ding, it's merely the usual nature of HN comments. It is a sort of foul play to selectively apply criteria. Here's a testable claim. If a HN participant does independent research on the Apple and Google encryption news recently (not you or me or lern_too_spel), that participant will find that encryption is not new nor the thing that law enforcement are critical about. They will find that there is a long history of FDE on Android and on Apple and on other products. They will find that both Apple and Google declared that they would provide encryption mechanisms that they would not have access to decryption keys for. They will find that this causes a ruckus at the FBI and other law enforcement. This is a testable claim. Not testable by you or by me. But it is testable by other readers. They should do it for themselves. The quality of my posts are not in question. I highly encourage readers to wade through my comment history (and that of 'xnull' as well) to links interesting and relevant to the current state of cybercontrol.

tptacek 12y ago

CALEA also doesn't apply to software companies; the law explicitly distinguishes between "telecommunications carriers" and entities providing "information services." The law simply does not require Google, Microsoft, &c to implement key escrow, and so far as I can tell, those companies don't.